Skip to content
Scanner online 200 stores scanned
magekwik scanner Magekwik Scanner home
Sign in

Checkout monitor, free

Know the moment your payment page changes

A skimmer on your checkout is invisible until the chargebacks arrive. We load the page on a schedule and email you the moment a script or security header changes. If nothing changes, you hear nothing. Free for one store or several.

  1. We load your page

    Daily or weekly, the way a shopper's browser does. Read-only: nothing is clicked or submitted.

  2. We fingerprint what it serves

    Every script, the contents of each script file, where it comes from, and the security headers.

  3. You hear about a change

    One email naming what was added, removed or altered. Pause or stop from any email.

Start watching your store

Takes a minute. We confirm your email first.

We confirm this address before anything runs (double opt-in).

How often

This check sees the page a visitor lands on. Pro adds live script reports from your shoppers' own browsers, which reach the checkout steps behind the cart, plus uptime checks and alerts to Slack or Teams. See monitoring plans

What it watches

  • Scripts added to or removed from the page
  • A change inside any script file, your own bundles included: each is fingerprinted as the browser receives it
  • Scripts from a domain the page never used, or from a known skimmer domain
  • Integrity (SRI) attributes added, removed or changed
  • Security headers changed

What it cannot see

This supports your PCI DSS 11.6.1 evidence: it shows unauthorised change to your payment page would be detected and alerted on. It is not the complete mechanism the standard describes, because we reach the page a visitor sees rather than the authenticated payment step behind your cart.

Inline scripts are not compared, because form keys and timestamps change them on every load, and a script served differently to a real shopper than to us would not show. That is why every scan also runs a Subresource Integrity check and lists the third-party origins loading without a hash.

Live script reports, in Pro, cover both gaps: your shoppers' browsers report from the payment step itself, including scripts served only to some visitors. The two work together, because a report cannot see a whitelisted script whose contents changed, and this check can.